@angular/core
@angular/core (latest known version: 22.1.0) has 12 known breaking changes on record, each backed by a source URL.
Security advisories
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
Angular vulnerable to Cross-site Scripting
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Angular vulnerable to XSS in i18n attribute bindings
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
Angular i18n vulnerable to Cross-Site Scripting
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Recent changes
The extension now bundles TypeScript version 6.0, which itself includes breaking changes, including [new defaults](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-6-0.html#simple-default-changes) such as `strict` being `true`. You will need to explicitly set `"strict": false` in your `tsconfig.json`. Alternatively, the extension supports configuring the `tsdk` in the [same way](https://code.visualstudio.com/docs/typescript/typescript-transpiling#_using-the-workspace-version-of-typescript) as the built in TS/JS extension.
Version 22.0.0 is a semver-major release over 21.2.18, but no breaking change was detected in the release notes text - flagged for manual review.
Version 21.0.0 is a semver-major release over 20.3.26, but no breaking change was detected in the release notes text - flagged for manual review.
breaking changes: * It is renamed to `provideCheckNoChangesConfig` * The behavior applies to _all_ checkNoChanges runs * The `useNgZoneOnStable` option is removed. This wasn't found to be generally more useful than `interval` - afterRender was renamed to afterEveryRender. - This commit deprecates `ng-reflect-*` attributes and updates the runtime to stop producing them by default. Please refactor application and test code to avoid relying on `ng-reflect-*` attributes. To enable a more seamless upgrade to v20, we've added the `provideNgReflectAttributes()` function (can be imported from the `@angular/core` package), which enables the mode in which Angular would be producing those attribites (in dev mode only). You can add the `provideNgReflectAttributes()` function to the list of providers within the bootstrap call.
breaking changes: * It is renamed to `provideCheckNoChangesConfig` * The behavior applies to _all_ checkNoChanges runs * The `useNgZoneOnStable` option is removed. This wasn't found to be generally more useful than `interval` - `provideExperimentalZonelessChangeDetection` is renamed to `provideZonelessChangeDetection` as it is now "Developer Preview" rather than "Experimental". - * `InjectFlags` has been removed. * `inject` no longer accepts `InjectFlags`. * `Injector.get` no longer accepts `InjectFlags`. * `EnvironmentInjector.get` no longer accepts `InjectFlags`. * `TestBed.get` no longer accepts `InjectFlags`. * `TestBed.inject` no longer accepts `InjectFlags`. - * `TestBed.get` has been removed. Use `TestBed.inject` instead. - afterRender was renamed to afterEveryRender. - - Angular no longer supports Node.js v18. - Node.js versions 22.0 to 22.10 are also no longer supported. Before upgrading to Angular v20, ensure the Node.js version is at least 20.11.1. For the full list of supported versions, visit: https://angular.dev/reference/versions - `PendingTasks.run` no longer returns the result of the async function. If this behavior is desired, it can be re-implemented manually with the `PendingTasks.add`. Be aware, however, that promise rejections will need to be handled or they can cause the node process to shut down when using SSR. - Uncaught errors in listeners which were previously only reported to `ErrorHandler` are now also reported to Angular's internal error handling machinery. For tests, this means that the error will be rethrown by default rather than only logging the error. Developers should fix these errors, catch them in the test if the test is intentionally covering an error case, or use `rethrowApplicationErrors: false` in `configureTestingModule` as a last resort. - The `any` overload has been removed from `injector.get`. It now only supports `ProviderToken<T>` and (deprecated since v4) `string`. - Animations are guaranteed to be flushed when Angular runs automatic change detection or manual calls to `ApplicationRef.tick`. Prior to this change, animations would not be flushed in some situations if change detection did not run on any views attached to the application. This change can affect tests which may rely on the old behavior, often by making assertions on DOM elements that should have been removed but weren't because DOM removal is delayed until animations are flushed. - `ApplicationRef.tick` will no longer catch and report errors to the appplication `ErrorHandler`. Errors will instead be thrown out of the method and will allow callers to determine how to handle these errors, such as aborting follow-up work or reporting the error and continuing. - This commit deprecates `ng-reflect-*` attributes and updates the runtime to stop producing them by default. Please refactor application and test code to avoid relying on `ng-reflect-*` attributes. To enable a more seamless upgrade to v20, we've added the `provideNgReflectAttributes()` function (can be imported from the `@angular/core` package), which enables the mode in which Angular would be producing those attribites (in dev mode only). You can add the `provideNgReflectAttributes()` function to the list of providers within the bootstrap call.
Version 19.0.0 is a semver-major release over 18.2.14, but no breaking change was detected in the release notes text - flagged for manual review.
Version 18.0.0 is a semver-major release over 17.3.12, but no breaking change was detected in the release notes text - flagged for manual review.
Version 17.0.0 is a semver-major release over 16.2.12, but no breaking change was detected in the release notes text - flagged for manual review.
Version 16.0.0 is a semver-major release over 15.2.10, but no breaking change was detected in the release notes text - flagged for manual review.
Version 15.0.0 is a semver-major release over 14.3.0, but no breaking change was detected in the release notes text - flagged for manual review.
Version 14.0.0 is a semver-major release over 13.4.0, but no breaking change was detected in the release notes text - flagged for manual review.
Version 13.0.0 is a semver-major release over 12.2.17, but no breaking change was detected in the release notes text - flagged for manual review.
fix(platform-browser): prevent memory leak of style nodes if shadow DOM encapsulation is used (#42005)
fix(core): do not retain dynamically compiled components and modules (#42003)
Check what changed for @angular/core since your installed version, live.
Open the playground →